Red Hat Product Security released an advisory (RHSA-2025:22372) addressing nine distinct security vulnerabilities in Mozilla Firefox packaged for Red Hat Enterprise Linux 8.8. The vulnerabilities include race conditions (CVE-2025-13012), mitigation bypasses in DOM components (CVE-2025-13013, CVE-2025-13018), use-after-free bugs in Audio/Video and WebRTC components (CVE-2025-13014, CVE-2025-13020), same-origin policy bypasses in DOM Workers and Notifications components (CVE-2025-13017, CVE-2025-13019), incorrect boundary conditions in JavaScript WebAssembly (CVE-2025-13016), and a spoofing issue (CVE-2025-13015). Red Hat has released Firefox version 140.5.0-1.el8_8 packages containing fixes for these vulnerabilities across multiple architectures and update services. The advisory rates the update as Important and provides instructions for applying the update. No known exploits in the wild have been reported at this time.

These vulnerabilities collectively could allow attackers to bypass security mitigations, execute use-after-free attacks potentially leading to arbitrary code execution, bypass same-origin policy restrictions, cause race conditions, and perform spoofing attacks within the Firefox browser environment. The impact affects the confidentiality, integrity, and security boundaries enforced by Firefox, potentially exposing users to security risks when browsing or using web applications. However, no known exploits in the wild have been reported according to the advisory.

Red Hat has released an official security update for Firefox version 140.5.0-1.el8_8 addressing all listed vulnerabilities. Users and administrators should apply this update promptly using the standard Red Hat update mechanisms as detailed in the advisory (https://access.redhat.com/articles/11258). Since this is a traditional software package and not a cloud service, remediation requires manual update by the system administrators. No additional mitigations are specified beyond applying the update.